Simple (VPN)

8/14/2019 Simple (VPN)

1/6

Understanding VPN TunnelingVPN Overview

The Routing and Remote Access service (RRAS), integrated in Windows 2000 and WindowsServer 2003 provides connectivity for remote users and remote offices to the corporate network.A remote access server provides the following two types of remote access connectivity:

Dial-up networking

Virtual private networking

Virtual Private Networks (VPNs) provide secure and advanced connections through a non-securenetwork by providing data privacy. Private data is secure in a public environment. Remote accessVPNs provides a common environment where many different sources such as intermediaries,clients and off-site employees can access information via web browsers or email. Many

companies supply their own VPN connections via the Internet. Through their ISPs, remote usersrunning VPN client software are assured private access in a publicly shared environment. Byusing analog, ISDN, DSL, cable technology, dial and mobile IP; VPNs are implemented overextensive shared infrastructures. Email, database and office applications use these secure remoteVPN connections.

A few of the main components needed to create VPN connections are listed below:

VPN services need to be enabled on the server.

VPN client software has to be installed on the VPN client. A VPN client utilizes the

Internet, tunneling and TCP/IP protocols to establish a connection to the network

The server and client have to be on the same network. A Public Key Infrastructure (PKI)

The server and client have to use the same:

" Tunneling protocols

" Authentication methods

" Encryption methods.

Centralized accounting

Remote access VPNs offer a number of advantages, including:

Third parties oversee the dial up to the network.

New users can be added with hardly any additional costs and with no extra expense to the

infrastructure.

Wan circuit and modem costs are eliminated.

Remote access VPNs call to local ISP numbers. VPNs can be established from anywhere

via the internet.
http://www.tech-faq.com/understanding-vpn-tunneling.shtmlhttp://www.tech-faq.com/understanding-vpn-tunneling.shtmlhttp://www.tech-faq.com/understanding-vpn-tunneling.shtmlhttp://www.tech-faq.com/understanding-vpn-tunneling.shtmlhttp://www.tech-faq.com/understanding-vpn-tunneling.shtmlhttp://www.tech-faq.com/understanding-vpn-tunneling.shtml


2/6

Cable modems enable fast connectivity and are relatively cost efficient.

Information is easily and speedily accessible to off-site users in public places via Internet

availability and connectivity.

VPN Tunneling OverviewTunneling is used to describe a method of using an internetwork infrastructure to transfer apayload. Tunneling is also known as the encapsulation and transmission of VPN data, or packets.IPSec tunnel mode enables IP payloads to be encrypted and encapsulated in an IP header so thatit can be sent over the corporate IP internetwork or Internet.

IPSec protects, secures and authenticates data between IPSec peer devices by providing perpacket data authentication. IPSec peers can be teams of hosts, or teams of security gateways.Data flows between IPSec peers are confidential and protected. The source and destinationaddresses are encrypted. The original IP datagram is left in tact. The original IP header is copiedand moved to the left and becomes a new IP header. The IPSec header is inserted between thesetwo headers. The original IP datagram can be authenticated and encrypted.

The tunnel is the logical path or connection that encapsulated packets travel through the transitinternetwork. The tunneling protocol encrypts the original frame so that its content cannot beinterpreted. The encapsulation of VPN data traffic is known as tunneling. The Transport ControlProtocol/Internet Protocol (TCP/IP) protocol provides the underlying transport mechanism forVPN connectivity.

The two different types of tunneling are:

Voluntary tunneling: With voluntary tunneling, the client starts the process of initiating a

connection with the VPN server. One of the requirements of voluntary tunneling is anexisting connection between the server and client. This is the connection that the VPNclient utilizes to create a tunneled connection with the VPN server.

Compulsory tunneling: With Compulsory tunneling, a connection is created between: Two VPN servers

Two VPN access devices - VPN routers

In this case, the client dials-in to the remote access server, by using whichever of thefollowing methods:

Through the local LAN.

Through an Internet connection.

The remote access server produces a tunnel, or VPN server to tunnel the data, therebycompelling the client to use a VPN tunnel to connect to the remote resources.

VPN tunnels can be created at the following layers of the Open Systems Interconnection (OSI)reference model:

Data-Link Layer - layer 2: VPN protocols that operate this layer are Point-to-Point

Tunneling Protocol (PPTP) and Layer 2 Tunneling Protocol (L2TP).

Network Layer - layer 3: IPSec can operate as a VPN protocol at the Network layer of the

OSI reference model.


3/6

Tunneling Protocols OverviewThe tunneling protocols are responsible for the following functions:

Tunnel maintenance: This involves both the creation and management of the tunnel.

VPN data transfer: This relates to the actual sending of encapsulated VPN data through

the tunnel.

The tunneling protocols provided by Windows Server 2003 are:

Point-to-Point Tunneling Protocol (PPTP)

Layer 2 Tunneling Protocol (L2TP)

Point-to-Point Tunneling Protocol (PPTP)Point-to-Point Tunneling Protocol (PPTP), an extension of Point-to-Point Protocol (PPP),encapsulates PPP frames into IP datagrams to transmit data over an IP internetwork. WindowsServer 2003 includes PPTP version 2. To create and manage the tunnel, PPTP utilizes a TCP

connection. A modified version of Generic Route Encapsulation (GRE) deals with data transferby encapsulating PPP frames for tunneled data. The encapsulated tunnel data can be encryptedand/or compressed. However, PPTP encryption can only be utilized when the authenticationprotocol is EAP-TLS or MS-CHAP. This is due to PPTP using MPPE to encrypt VPN data in aPPTP VPN, and MPPE needing EAP-TLS or MS-CHAP generated encryption keys. With theWindows Server 2003 implementation of PPTP, both 40-bit encryption and 128-bit encryption issupported.

The authentication methods supported by PPTP are the same authentication mechanismssupported by PPP:

PAP

CHAP

MS-CHAP

EAP

Layer 2 Tunneling Protocol (L2TP)Layer 2 Tunneling Protocol (L2TP) is a combination of the benefits and features of PPTP andCisco's Layer 2 Forwarding (L2F) protocol. L2TP encapsulates PPP frames, and sendsencapsulated data over IP, frame relay, ATM and X.25 networks. With L2TP, the PPP and layertwo end-points can exist on different devices. L2TP can also operate as a tunneling protocol overthe Internet. L2TP uses UDP packets and a number of L2TP messages for tunnel maintenance.

UDP is used to send L2TP encapsulated PPP frames as tunneled data.

While L2TP can provide encryption and compression for encapsulated PPP frames, you have touse Microsoft's implementation of L2TP with the IPSec security protocol. When L2TP is usedwith IPSec, the highest level of security is assured. This includes data confidentiality andintegrity, data authentication, as well as replay protection. IPSec protects the packets of data andtherefore provides security on insecure networks such as the Internet. This is due to IPSecsecuring the actual packets of data, and not the connection used to convey the data. IPSec utilizesencryption, digital signatures and hashing algorithms to secure data.
http://www.tech-faq.com/understanding-vpn-tunneling.shtmlhttp://www.tech-faq.com/understanding-vpn-tunneling.shtmlhttp://www.tech-faq.com/understanding-vpn-tunneling.shtmlhttp://www.tech-faq.com/understanding-vpn-tunneling.shtmlhttp://www.tech-faq.com/understanding-vpn-tunneling.shtml


4/6

IPSec provides the following security features:

Authentication; digital signatures are used to authenticate the sender.

Data integrity; hash algorithms ensure that data has not been tampered with while in

transit.

Data privacy; encryption ensures that data cannot be interpreted while in transit.

Replay protection; protects data by preventing unauthorized access by any attackers who

resend data.

The Diffie-Hellman key agreement algorithm is used to generate keys. This makes it

possible for confidential key agreement to occur.

Nonrepudiation; public key digital signatures authenticate the origin of the message.

The two IPSec protocols are:

Authentication Header (AH); provides data authentication, data integrity and replay

protection for data.

Encapsulating Security Payload (ESP); provides data authentication, data confidentiality

and integrity, and replay protection.

How to install Routing and Remote Access Service (RRAS)

1. Click Start, and then click Manage Your Server.

2. Select the Add or remove a role option.

3. The Configure Your Server Wizard starts.

4. On the Preliminary Steps page, click Next.

5. A message appears, informing you that the Configure Your Server Wizard is detectingnetwork settings and server information.

6. When the Server Role page appears, select the Remote Access/VPN Server option andthen click Next.

7. On the Summary of Selections page, click Next.

8. The Welcome to the Routing and Remote Access Server Setup Wizard page is displayed

How to install and enable a VPN Server

1. Click Start, Administrative Tools, and then click Routing And Remote Access to open theRouting And Remote Access management console.

2. In the console tree, select the server that you want to configure.

3. Right-click the server, and then click Configure And Enable Routing And Remote Accessfrom the shortcut menu.

4. The Routing and Remote Access Server Setup Wizard starts.

5. Click Next on the Routing and Remote Access Server Setup Wizard Welcome page.

6. On the Common Configuration page, select the Remote Access (Dial-Up Or VPN)option. Click Next.

7. On the Remote Access page, select the VPN checkbox.


5/6

8. On the VPN Connection page, choose the interface which is connected to the Internet andclick Next.

9. On the IP Address Assignment page, select the Automatically option if you want use aDHCP server for IP address assignment for remote clients; or select the From A SpecifiedRange Of Addresses option if you want to specify your own address range.

10.If you chose the From A Specified Range Of Addresses option, proceed to specify theaddress range for remote clients. Click Next.

11.On the Managing Multiple Remote Access Servers page, select the No, Use Routing AndRemote Access To Authenticate Connection Requests option. Click Next.

12. Click Finish when the Completing the Routing and Remote Access Server Setup Wizardpage appears.

How to configure PPTP ports or L2TP ports

1. Click Start, Administrative Tools, and then click Routing And Remote Access to open theRouting And Remote Access management console.

2. In the console tree, expand the node for the server that you want to configure.3. Right-click Ports and then select Properties from the shortcut menu to open the Ports

Properties dialog box.

4. Select WAN Miniport (PPTP) or select WAN Miniport (L2TP).

5. Click the Configure button.

6. The Configure Device dialog box opens.

7. In the Maximum Ports box, specify the number of connections that the port type whichyou have selected can support. The default configuration setting when the RRAS isinstalled is 5 PPTP ports and 5 L2TP ports.

8. If you want to specify the IP address of the public interface to which VPN clientsconnect, use the Phone Number For This Device box on the Configure Device dialogbox.

9. If you want to disable connections for the port type, deselect the Use the Remote AccessConnections (Inbound Only) checkbox on the Configure Device dialog box.

10.If you do not want to allow the specific VPN type to be used for demand-dialconnections, deselect the Demand-Dial Routing Connections (Inbound And Outbound)checkbox.

11. Click OK to close the Configure Device dialog box.

12. Click OK to close the Ports Properties dialog box

How to configure a VPN client1. On the client computer open Control Panel.

2. Right-click Network Connections and then select Open from the shortcut menu.

3. Click New Connection Wizard to start the New Connection Wizard.

4. Click Next on the Welcome to the New Connection Wizard page.


6/6

5. On the Network Connection Type page, select Connect to the network at my workplace,and then click Next.

6. Click Virtual Private Network Connection, and click Next.

7. Enter a name for the connection and click Next.

8.Specify the external IP address of the VPN server, or the FQDN of the VPN server, andthen click Next.

9. Select the Anyone's use - If you want the connection to be available to everyone who usesthe computer and then click Next.

10. When the Completing the New Connection Wizard page appears, click Finish.

11. The logon dialog box is displayed after you click the Finish button to complete the NewConnection Wizard.

Simple (VPN)

Documents

Transcript of Simple (VPN)